CVE-2026-73563
CVE-2026-73563: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium4.7
Medium [CVE-2026-73563] @backstage/plugin-auth-backend: Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass
CVE-2026-73563Source published Source updated
Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns and the auth.experimentalClientIdMetadataDocuments allowedClientIdPatterns and allowedRedirectUriPatterns options. A hostname wildcard can match across URL component boundaries, allowing an attacker-controlled redirect URI with a trusted hostname suffix in its path to pass the allowlist and receive an OAuth authorization code after a victim completes the flow. Patterns without an explicit protocol can match unintended protocols, and redirect URIs containing embedded…
- Affected products in this advisory
- Red Hat Ansible Automation Platform 2.1
- Red Hat Ansible Automation Platform 2.2
- Source-reported affected versions
- < 0.29.2
- Source-reported fixed versions
- 0.29.2
- ansible-automation-platform/automation-portal:1788775748
- ansible-automation-platform/automation-portal:1788783591
- RHSA-2026:65118
1 more entries in the full advisory.
- Mitigation guidance
- Do not enable the experimental dynamic client registration or client ID metadata document features. If these features are currently enabled, review and restrict the allowedRedirectUriPatterns and allowedClientIdPatterns configurations to use fully qualified hostnames with explicit protocols rather than wildcard or protocol-less patterns.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.